PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a stack-based buffer by changing the user's own password to a purpose-crafted value. This often suffices to execute arbitrary code as the PostgreSQL operating system account.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql14Upgrade postgresqlUpgrade postgresql15 | Jul 5, 2019 | Jun 26, 2019 |
| Centos_linux | — | Upgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-serverUpgrade postgresql-debuginfoUpgrade postgresql-plperlUpgrade postgresql-contribUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-pltclUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-test-rpm-macrosUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade postgresql-docsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-static | Sep 9, 2020 | Jun 26, 2019 |
| Freebsd | — | Upgrade postgresql10-serverUpgrade postgresql11-server | Jun 27, 2019 | Jun 27, 2019 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Mar 13, 2020 | Jun 26, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade postgresql-libsUpgrade postgresqlUpgrade postgresql-testUpgrade postgresql-serverUpgrade postgresql-docsUpgrade postgresql-pltclUpgrade postgresql-develUpgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-plpython | Aug 28, 2019 | Jun 26, 2019 |
| Oracle_linux | — | Upgrade postgresql-plperlUpgrade rh-postgresql10-postgresql-plpythonUpgrade rh-postgresql10-postgresql-server-syspathsUpgrade rh-postgresql10-postgresql-pltclUpgrade rh-postgresql10-postgresql-serverUpgrade rh-postgresql10-postgresql-plperlUpgrade postgresql-testUpgrade rh-postgresql10-postgresql-staticUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade rh-postgresql10-postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-contribUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-develUpgrade postgresql-staticUpgrade rh-postgresql10-postgresqlUpgrade rh-postgresql10-postgresql-contrib-syspathsUpgrade rh-postgresql10-postgresql-testUpgrade rh-postgresql10-postgresql-develUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade rh-postgresql10-postgresql-libsUpgrade rh-postgresql10-postgresql-docsUpgrade rh-postgresql10-postgresql-syspaths | Sep 10, 2020 | Jun 20, 2019 |
| Postgres | — | Upgrade to PostgreSQL version 11.4 | Jun 21, 2019 | Jun 21, 2019 |
| Redhat_linux | — | Upgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-test-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-upgradeUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-serverUpgrade postgresql-docs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-testUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-server-develUpgrade postgresql-upgrade-develUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contribUpgrade postgresqlUpgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-server-debuginfo | Sep 9, 2020 | Jun 26, 2019 |
| Suse | — | Upgrade libpq5Upgrade postgresql10-pltclUpgrade postgresql10-contribUpgrade postgresql10-docsUpgrade postgresql12-plperlUpgrade postgresql-server-develUpgrade postgresql-develUpgrade postgresql10-plpythonUpgrade postgresql12Upgrade postgresql10Upgrade postgresql10-develUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-plpythonUpgrade python3-psycopg2Upgrade postgresql-plperlUpgrade postgresql-contribUpgrade libecpg6Upgrade postgresql10-testUpgrade postgresql12-plpythonUpgrade libpq5-32bitUpgrade postgresql12-server-develUpgrade postgresql10-serverUpgrade postgresql12-pltclUpgrade libecpg6-32bitUpgrade postgresqlUpgrade postgresql12-serverUpgrade postgresql10-plperlUpgrade postgresql-docsUpgrade postgresql12-develUpgrade postgresql12-docsUpgrade postgresql12-contrib | Jul 10, 2019 | Jun 20, 2019 |
| Ubuntu | — | Upgrade postgresql-10Upgrade postgresql-11 | Jun 21, 2019 | Jun 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 26, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub